Avoid possible memleak in X509_policy_check()

[openssl.git] / crypto / x509v3 / pcy_tree.c

diff --git a/crypto/x509v3/pcy_tree.c b/crypto/x509v3/pcy_tree.c
index 8c13c53fc7fd31a0297e4ef2f396ea9db68a6fab..b3d1983f9e050093ce8c3c24233d691b89494cc4 100644 (file)
--- a/crypto/x509v3/pcy_tree.c
+++ b/crypto/x509v3/pcy_tree.c
@@ -118,7 +118,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
         X509_check_purpose(x, -1, 0);
 
         /* If cache is NULL, likely ENOMEM: return immediately */
-        if ((cache = policy_cache_set(x)) == NULL)
+        if (policy_cache_set(x) == NULL)
             return X509_PCY_TREE_INTERNAL;
     }
 
@@ -129,7 +129,7 @@ static int tree_init(X509_POLICY_TREE **ptree, STACK_OF(X509) *certs,
      * decremented for every non-self-issued certificate in the path, but may
      * be further reduced by policy constraints in a non-leaf certificate.
      *
-     * The ultimate policy set is the interesection of all the policies along
+     * The ultimate policy set is the intersection of all the policies along
      * the path, if we hit a certificate with an empty policy set, and explicit
      * policy is required we're done.
      */
@@ -638,6 +638,7 @@ int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
 {
     int init_ret;
     int ret;
+    int calc_ret;
     X509_POLICY_TREE *tree = NULL;
     STACK_OF(X509_POLICY_NODE) *nodes, *auth_nodes = NULL;
 
@@ -675,11 +676,14 @@ int X509_policy_check(X509_POLICY_TREE **ptree, int *pexplicit_policy,
     }
 
     /* Tree is not empty: continue */
-    if ((ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0 ||
-        !tree_calculate_user_set(tree, policy_oids, auth_nodes))
+
+    if ((calc_ret = tree_calculate_authority_set(tree, &auth_nodes)) == 0)
         goto error;
-    if (ret == TREE_CALC_OK_DOFREE)
+    ret = tree_calculate_user_set(tree, policy_oids, auth_nodes);
+    if (calc_ret == TREE_CALC_OK_DOFREE)
         sk_X509_POLICY_NODE_free(auth_nodes);
+    if (!ret)
+        goto error;
 
     *ptree = tree;